Panopticon — a privacy observatory in Rust: eBPF flow capture, cookie fingerprinting, and a ratatui dashboard

I built a privacy-analysis tool in Rust and wanted to share it here first. The stack has some bits this crowd might find interesting: eBPF for outbound flow capture (via a small pinned-toolchain crate), a binary search over a 452k-range ip2asn table for network attribution, a DNS tap + reverse-DNS to recover hostnames under DoH, and a ratatui TUI. Pure Rust, no unsafe outside the eBPF boundary.

Panopticon reads what's already on your machine — your browser's cookies and (optionally) your outbound network connections — and shows you three things most people never see:

• What personal data is sitting in your cookies right now. It decodes cookie values and surfaces actual PII: email, name, location, device IDs — and which sites hold each. When I ran it on myself, my name and email were sitting in plaintext in cookies on major sites.
• Who's linking your identity across sites. When the same tracking ID shows up on multiple unrelated sites, a broker (Criteo, Google, etc.) can merge your activity into one profile. Panopticon detects these and names the broker.
• Where your traffic actually goes, live — every outbound connection resolved to the company that owns the destination IP, even when your DNS is encrypted.

It's a terminal dashboard (7 tabs), reads Firefox cookies read-only, and — because it's a privacy tool — holds itself to a privacy standard: raw cookie values are never written to disk, there's no telemetry, and nothing ever leaves your machine. It runs without root for the cookie/privacy analysis; only the live network capture (eBPF) needs privileges.

Detection is by fingerprint, not a domain blocklist — so it catches first-party trackers that blocklists miss. Broker attribution uses the DuckDuckGo Tracker Radar dataset; network attribution uses a full ip2asn table.

Repo (MIT, Linux): https://github.com/Consigliere-X/panopticon

It's a personal/research project — feedback, issues, and PRs welcome. Happy to answer anything about how it works.

(Screenshots in the README are redacted.)